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ABSTRACT 

The  Threat  Oriented  Survivability  Optimization  Model  (TOSOM)  was 
developed  to  provide  a  methodology  to  enable  the  Survivability 
Technology  Area  of  the  U.S.  Army  Tank-automotive  and  Armaments 
Command  Research,  Development  and  Engineering  Center  (TARDEC)  to 
perform  rapid  turn  around,  first  order  analyses  of  survivability  trade-offs 
in  the  design  or  modernization  of  military  systems.  TOSOM  provides  an 
easy  to  use  capability  to  do  analyses  of  alternative  survivability  suites.  It 
contains  embedded  error  trapping  to  .  insure  that  input  data  is 
mathematically  consistent,  as  well  as  providing  a  means  for  easily 
assessing  the  results  of  a  model  run.  TOSOM  is  a  methodology, 
implemented  in  software,  used  for:  selecting  feasible  solutions  from  a 
large  number  of  possible  responses,  estimating  the  variety  and  magnitude 
of  combat  risk  to  a  system,  generating  discussion  and  exchange  of 
information.,  and  enabling  “what-if”  analyses.  Because  of  its  ease  of  use, 
which  is  quick,  reusable,  and  repeatable,  TOSOM  efficiently  organizes  the 
complex  problem  of  designing  survivability  suites. 

The  main  goal  of  this  paper  is  to  outline  the  steps  required  in  inputting 
data  when  performing  a  trade-off  study  using  TOSOM,  paying  especial 
attention  to  the  type  and  quantity  of  data  required  in  such  a  study.  A 
secondary  and  minor  goal  is  to  give  some  indication  of  how  the  output  of  a 
TOSOM  run  appears.  A  detailed  description  of  the  organization  and 
processing  of  the  output  data  from  TOSOM  will  be  left  to  a  future  paper. 

(U)  Introduction 
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(U)  TOSOM  is  a  first-order,  easy  to  use,  model  that  permits  the  evaluation  of 
combinations  of  countermeasure  technologies  in  a  postulated  threat  environment.  The  model  is 
designed  to  evaluate  a  single  platform  in  a  given  threat  environment.  In  the  sections  below  a 
detailed  outline  will  be  presented  of  the  steps  necessary  in  order  to  input  the  data  required  in 
performing  a  survivability  study  using  the  model.  And  in  addition,  an  estimate  of  the  amount  of 
information  required  and  of  the  type  of  information  required  will  be  provided.  This  quantity-of- 
information  estimate  will  generally  be  a  surprise  to  the  causal  user,  since  the  volume  of  data 
required  is  an  order  of  magnitude  greater  than  the  initial  user  of  the  model  or  viewer  of  its  output 
believes. 

(U)  Since  threats  or  rather  the  countering  of  threats  is  the  heart  of  survivability  and 
survivability  trade-off  analysis,  threat  trees  are  a  sensible  place  to  begin  a  discussion  of  the 
process  of  performing  a  TOSOM  study.  However,  to  explain  threat  trees,  it  s  of  value  to  have 
some  minimal  understanding  of  the  mathematical  concept  of  trees,  and  we  spend  considerable 
time  elaborating  the  concept,  since  Schwarz,  in  [2],  has  stated  that  there  is  some  confusion  in  the 
threat  community  as  to  what  exactly  is  a  threat  tree. 


(U)  Trees 

(U)  Trees  are  a  special  type  of  graph.  Graph  theory,  and  trees  as  a  special  type  of 
graph,  is  an  extensive  area  of  mathematics,  see  for  example  [1],  though  the  concept  is  a  simple 
one  to  understand.  A  graph  is  a  collection  of  nodes  (points)  with  the  property  that  some  of  all  the 
possible  pairs  of  nodes  are  joined  by  an  edge  (line.).  Examples  of  graphs  are  given  in  Figure  1 
below. 


* 


(a)  (b) 


(i) 


(2) 


(C) 


(U)  Figure  1 :  Examples  of  graphs 

(U)  In  Figure  1 ,  (a)  has  3  nodes  and  1  edge,  (b)  has  7  nodes  and  8  edges,  and  (c)  has  8 
nodes  and  7  edges.  In  ar>  obvious  sense,  (a)  is  an  example  of  a  non-connected  graph,  while  (b) 
and  (c)  are  examples  of  connected  graphs. 
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(U)  A  tree  is  a  connected  graph  with  no  loops.  As  just  noted,  (b)  and  (c)  in  Figure  1 
are  connected.  However,  (b)  has  a  loop  and  is  therefore  not  a  tree,  (c)  is  a  tree. 

(U)  A  tree  structure  is  a  tree  with  the  nodes  labeled  in  a  particular  fashion.  A  node  of 
the  tree  is  selected  and  called  the  Level  0  node.  The  Level  0  node  branches  (think  of  an  upside 
down  tree)  into  one  or  more  Level  1  nodes.  Each  Level  1  node  can  be  either  a  terminal  node 
(that  is,  it  does  not  branch),  or  can  branch  into  several  Level  2  nodes.  This  process  continues 
until  at  some  level,  every  node  is  a  terminal  node. 

(U)  A  given  tree  can  have  several  distinct  tree  stmctures  associated  with  it.  For 
example,  in  Figure  1(c),  if  (1)  is  chosen  as  the  Level  0  node,  then  there  is  1  Level  1  node;  2  level 
2  nodes,  1  of  which  is  terminal;  1  Level  3  node;  and  3  Level  4  nodes,  all  3  of  which  are  terminal 
nodes.  But  if  (2)  in  Figure  1(c)  is  chosen  as  the  Level  0  node,  then  there  are  2  Level  1  nodes; 
and  5  Level  2  nodes,  all  of  which  are  tenninal.  Thus,  a  tree  stmcture  depends  upon  the 
underlying  tree,  and  upon  the  node  chosen  to  be  the  Level  0  node. 

(U)  An  aside  is  worth  noting  before  proceeding  with  TOSOM.  That  is, 
mathematically  trees  with  infinitely  long  branches  occur,  but  tree  stmctures  as  defined  above 
restrict  branches  to  a  finite,  though  variable,  length.  That  is,  every  branch  of  the  tree  starts  at  the 
unique  Level  0  node,  and  after  a  finite  number  of  branches,  ends  at  a  Level  k  (for  some  positive 
integer  k)  terminal  node. 

(U)  A  threat  tree  is  a  particular  type  of  tree  stmcture.  In  a  threat  tree,  each  branch  is 
assigned  a  probability,  with  the  constraint  that  the  sum  of  the  probabilities  of  all  braches  leaving 
each  node  must  be  1.  The  actual  threats  in  a  threat  tree  are  those  nodes  that  have  no  branches 
leaving  them;  that  is,  the  actual  threats  are  the  terminal  nodes  in  the  threat  tree. 

(U)  A  TOSOM  threat  tree  has  two  additional  restrictions.  First,  each  node  can  have  at 
most  five  branches  leaving  it.  Thus,  there  are  at  most  5  level  1  nodes,  at  most  5x5  =25  level  2 
nodes,  at  most  5x5x5  =125  level  3  nodes,  etc.  The  second  restriction  is  that  there  are  no  nodes 
deeper  than  level  5.  A  typical  TOSOM  threat  tree  is  shown  is  Figure  2. 
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(U)  Figure  2:  A  typical  TOSOM  threat  tree 
(U)  Structure  of  a  TOSOM  Study 

(U)  The  first  step  in  executing  a  TOSOM  study  is  to  create  a  threat  tree.  TOSOM 
threat  trees  can  vary  widely,  from  a  single  threat  (unlikely,  but  possible)  to  a  maximum  of  55  = 
3,125  threats  (possible,  but  also  unlikely).  A  typical  TOSOM  threat  tree  will  have  around  30 
threats  (terminal  nodes)  and  around  50  branches  providing  a  unique  branching  path  to  each  threat 
from  the  level  0  node.  As  noted  above,  each  branch  must  have  a  probability  assigned  to  it,  with 
the  sum  of  the  branch  probabilities  leaving  each  node  summing  to  1.  Thus,  a  typical  TOSOM 
threat  tree  will  require  50  data  points  for  its  creation. 

(U)  Cnee  the  distribution  of  the  threat  has  been  specified  by  the  branch  probabilities, 
the  next  step  is  to  specify  the  probability  of  acquisition,  the  probability  of  hit,  and  the  probability 
of  kill  for  each  threat.  In  the  typical  threat  tree  offered  above,  this  will  require  3x30  =90  data 
points. 
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(U)  At  this  point  in  the  study  sequence  it’s  time  to  consider  the  particular 
countemieasures  available  for  incorporation  onto  the  platform.  However,  before  the 
countermeasures  are  specified,  it’s  necessary  to  specify  the  burdens  that  are  of  importance  to  the 
study.  Burdens  are  various  properties  associated  with  each  countermeasure.  They  are  specified 
by  the  study  manager,  but  will  generally  include  items  such  as  cost  of  the  countermeasure, 
weight  of  the  countermeasure,  space  required  by  the  countermeasure,  and  other  factors  the  study 
manager  deems  important.  At  times,  depending  upon  the  study,  the  space  claim  burden  may  be 
broken  into  two  burdens:  volume  under  armor,  and  volume  not  under  armor.  Also,  at  times, 
power  consumption  may  be  of  importance  as  a  burden;  at  others,  peak  power  consumption.  Each 
burden  requires  the  specification  of  a  maximum  value.  More  about  the  role  these  maximum 
values  play  when  the  model’s  combinations  of  countermeasures  is  discussed. 

(U)  The  study  sequence  now  requires  the  specification  of  the  countermeasure 
technologies  that  are  to  be  considered.  These  countermeasures  will  generally  include  armor 
packages  of  various  types,  signature  reduction  techniques,  jammers,  and  any  of  various  other 
devices  that  the  design  engineer  might  conceive.  Each  countermeasure  will  require  a  value  for 
each  burden,  giving  its  contribution  to  that  burden.  Also,  each  countermeasure  will  need  to 
specify  its  effectiveness  against  each  threat.  Thus,  in  a  typical  study  with  30  threats  and  4 
burdens,  each  countermeasure  will  need  to  provide  34  data  points.  If  it  s  noted  also  that  a  typical 
study  might  have  8  countermeasures,  then  the  specification  of  the  countermeasures  in  that  study 
will  require  8x34  -272  data  points.  TOSOM  is  a  simple  model,  but  like  all  models,  it  is  data 
intensive. 

(U)  An  additional  point  regarding  the  input  of  countermeasures  into  the  TOSOM 
model  requires  a  remark.  Countermeasures  can  be  grouped.  For  example,  if  there  are  three 
types  of  armor  under  consideration  as  potential  countermeasures,  but  at  most  one  of  them  can  be 
installed  on  the  platform  being  studied,  then  the  three  armor  countermeasures  would  be  grouped. 
In  a  grouped  collection  of  countermeasures,  TOSOM  in  determining  possible  countermeasure 
suites  would  choose  at  most  one  countermeasure  from  each  grouped  collection  of 
countermeasures . 

<U)  For  example,  if  A1  and  A2  are  two  armor  countermeasures  which  are  grouped, 
and  SI  and  S2  are  two  signature  countermeasures  which  are  grouped,  and  J  is  a  jammer,  then 
TOSOM  would  generate  at  most  (more  about  this  below)  18  countermeasure  suites,  not  the  32 
suites  normally  expected  from  5  individual  countermeasures. 

(U)  Normally,  if  there  are  k  countemieasures  in  a  TOSOM  study,  there  will  be  at  most 
2k  countermeasure  suites,  including  the  baseline  (that  is,  the  platform  with  no  countermeasures). 
There  are  two  circumstances  that  can  reduce  the  number  of  countermeasure  suites.  The  first,  as 
noted  above,  is  the  grouping  of  some  of  the  countermeasures.  The  second  has  to  do  with 
burdens,  and  an  example  with  make  the  circumstance  and  the  methodology  clear. 

(U)  'Suppose,  for  example,  that  cost  is  a  burden.  Recall  that  each  burden  is  assigned  a 
maximum  value,  and  suppose  in  this  example  that  the  maximum  value  for  cost  is  $500,000. 
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Suppose  that  A  is  an  aimor  package  with  a  cost  of  $100,000.  Suppose  that  P  is  an  active 
protection  package  with  a  cost  of  $300,000.  Finally,  suppose  that  S  is  a  signature  reduction 
countermeasure  with  a  cost  of  $250,000.  As  noted  above,  with  3  countermeasures,  8 
countermeasure  suites  is  the  maximum  number  possible,  but  in  this  instance  TOSOM  will  only 
produce  6  countermeasure  suites.  The  suite  consisting  of  P  and  S  will  be  rejected  because  its 
total  cost,  $550,000,  exceeds  the  cost  burden  limit.  Likewise,  the  suite  consisting  of  all  three 
countermeasures  will  be  rejected.  The  other  6  countermeasure  suites  will  all  be  considered,  since 
each  has  a  cost  below  the  $500,000  maximum  cost.  For  reference,  those  6  suites  are:  the 
baseline,  no  cost;  the  armor  package  A  with  a  cost  of  $100,000;  the  active  protection  package  P 
with  a  cost  of  $300,000;  the  signature  reduction  package  S  with  a  $250,000  cost;  the  suite 
consisting  of  A  and  P  with  a  cost  of  $400,000;  and  finally,  the  suite  consisting  of  A  and  S  with  a 
cost  of  $350,000. 

(FI)  For  each  countermeasure  suite  (the  baseline  will  always  be  one  of  them)  that 
TOSOM  generates  TOSOM  will  also  produce  an  estimate  of  the  platform’s  survivability  when 
it’s  equipped  with  that  suite.  For  details  on  how  these  survivability  values  are  computed,  please 
see  [3],  These  survivability  values  can  be  used  by  the  decision  maker  in  a  variety  of  ways.  For 
example,  the  survivability  of  various  suites  can  be  compared  to  that  of  the  baseline  platform  and 
these  survivabilities  can  be  related  to  any  of  the  burden  values,  but  with  cost  almost  always  being 
the  one  of  primary  interest.  The  comparison  between  cost  and  survivability  provided  by  a  typical 
TOSOM  study  is  frequently  displayed  as  in  Figure  3.  This  provides  the  decision  maker  with  a 
quick  way  to  estimate  the  marginal  utility  of  increasing  survivability  as  a  function  of  increasing 
cost. 
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(FJ)  Figure  3:  A  final  result  of  a  TOSOM  study 


(U)  Conclusion 
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(U)  How  many  data  points  are  required  for  a  TOSOM  study?  Combining  what  has 
been  laid  out  above  the  question  can  now  be  answered.  This  estimate  will  depend  upon  four 
quantities,  only  three  of  which  can  be  know  exactly.  The  three  that  can  be  know  exactly  are:  the 
number  of  threats,  T;  the  number  of  burdens,  B;  and  the  number  of  countermeasures,  C.  The 
quantity  that  can’t  be  known  exactly  is  the  number  of  branches  in  the  threat  tree,  since  this 
number  in  not  a  direct  dependence  upon  T  but  is  also  affected  by  the  structure  of  the  tree. 
However,  it  will  not  be  an  egregious  error  to  assume  that  the  number  of  branches  is  double  the 
number  of  threats.  On  that  assumption,  there  are  2xT  branch  probabilities.  That  is,  2xT 
encounter  probabilities  will  be  required.  Since  each  threat  requires  probabilities  ot  acquisition, 
hit,  and  kill,  3xT  data  points  will  be  required  to  specify  threat  lethality.  B  data  points  will  be 
required  to  specify  the  maximum  values  for  the  burdens.  Since  each  countermeasure,  C,  must 
state  its  contribution  to  each  burden,  B,  CxB  data  points  will  be  needed.  And  finally,  since  each 
countermeasure,  C,  must  specify  its  effectiveness  against  each  threat,  T,  CxT  data  points  will  be 
required. 

(U)  In  total,  if  there  are  T  threats,  B  burdens,  and  C  countermeasures  in  a  TOSOM 
study,  then  approximately 

(C  +5)xT  +(C  +l)xB 

data  points  will  be  required.  For  example,  a  typical  TOSOM  study  might  have  30  threats,  4 
burdens,  and  S  countermeasures.  Thus,  the  study  would  require  the  specification  of 
(8  +5)x30  +(8  +I)x4  =426  data  points. 

(U)  Summary 

(U)  The  step-by-step  data  requirements  for  a  TOSOM  study  have  been  explained.  A 
reference  to  the  methodology  TOSOM  uses  in  its  calculation  of  survivability  has  been  provided, 
[3],  and  a  forthcoming  paper  will  discuss  how  the  output  of  TOSOM  is  analyzed  and  presented,  a 
hint  of  which  was  provided  in  Figure  3  above. 
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